analyzing-expensive-users
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and interprets LLM trace data (prompts and outputs) from the
$ai_generationevent. This content is untrusted and could contain adversarial instructions intended to influence the agent's interpretation or subsequent tool usage. - Ingestion points: Trace content is retrieved through
posthog:query-llm-traceandposthog:execute-sql(SKILL.md). - Boundary markers: The instructions do not define clear delimiters or "ignore" warnings when processing the retrieved trace text.
- Capability inventory: The agent has the ability to execute arbitrary HogQL queries via
posthog:execute-sqland generate platform-qualified URLs. - Sanitization: There is no explicit sanitization or filtering logic applied to the trace content before it is analyzed by the agent.
- [SAFE]: The skill handles sensitive user information (names, emails, and internal IDs) but includes explicit instructions to minimize data exposure. It specifically directs the agent to only select necessary label columns and to avoid serializing full property blobs to protect user privacy. All tools and external resource patterns are consistent with the official 'posthog' vendor.
Audit Metadata